5 Software Management Gaps That Could Derail Your Next SOC 2 Audit (And How to Close Them)

Companies are often asked to provide a SOC 2 report to demonstrate that they have appropriate controls in place to protect customer data. Preparing for an audit involves more than documenting security policies. Companies also need evidence that software access is granted, reviewed, and removed according to their established procedures.

Without a clear process for managing software access, companies can struggle to provide that evidence during an audit. Here are five common software management gaps that can put your SOC 2 audit at risk and how to address them.

What is SOC 2?

System and Organization Controls 2 (SOC 2) is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA). It provides criteria for independent auditors to evaluate how service organizations manage controls related to security, availability, processing integrity, confidentiality, and privacy. Originally developed in the US, SOC 2 is now widely used by SaaS companies and technology providers worldwide.

Here are the key things to know about SOC 2:

Here are five common software management gaps that can create problems during a SOC 2 audit.

Gap #1: Employees retain access to SaaS applications after they leave

When an employee leaves, their access to company applications should be removed promptly. But when offboarding relies on manual coordination between HR and IT, it's easy for accounts to be overlooked. Some may remain active, while others are disabled without a clear record of when access was removed.

During a SOC 2 audit, these issues can raise questions about whether offboarding controls are working as intended. Auditors may uncover:

• Access isn't removed on time: Delays in communication between HR and IT can leave former employees with access to company applications after their departure

• Some applications are overlooked: Removing access through Single Sign-On (SSO) may not cover applications with separate login credentials, leaving accounts active

• Accounts missed during offboarding: Without a follow-up review, some application accounts may remain active after an employee leaves

• There's no record of access removal: Even when accounts are disabled promptly, missing documentation can make it difficult to show auditors that offboarding procedures were followed

The solution: Connect employee offboarding to software access management so that departure events trigger timely deprovisioning across connected applications. Maintain records of access changes to support audit reviews.

How Deel IT helps: Deel IT connects Deel HR or a compatible HRIS with IT workflows, helping teams automate access removal across supported applications when employees leave. This reduces manual handoffs and makes it easier to track offboarding activity and identify licenses that can be reclaimed.

See also: What Happens When Access Is Not Revoked on Time

Gap #2: SaaS applications are being used without IT's knowledge

Employees sometimes sign up for SaaS tools without involving IT, a practice known as shadow IT. If these applications store or access company or customer data, they can introduce security risks that IT teams aren't aware of.

This becomes a problem during a SOC 2 audit, when companies need to demonstrate that relevant systems and data are covered by appropriate controls. Without visibility into the software employees use, several gaps can emerge:

• Untracked applications: Employees may use tools that aren't included in the company's software inventory, leaving IT unaware of where sensitive data is stored or processed

• Missed security reviews: Applications adopted without IT approval may never be assessed for security risks or how they handle company data

• Sensitive data stored in unapproved tools: Employees may upload customer information or internal documents to applications that haven't been assessed for appropriate security and data protection controls.

• Unmanaged user access: When IT doesn't know an application is being used, it may not review who has access or remove that access when employees leave

The solution: Maintain an up-to-date software inventory and establish a clear approval process for new applications. Use identity and SSO integrations to improve visibility into connected tools, alongside other discovery methods to identify applications operating outside those systems.

How Deel IT helps: Deel IT helps IT teams manage application access through connected identity and software-management workflows. It provides visibility into application access, discovered software, and usage, helping teams review access, spot apps that need evaluation, and maintain oversight as they grow.

Read: IAM Best Practices

Gap #3: Access permissions are not reviewed after they are granted

Employees are typically granted access to the tools they need during onboarding. But as they change roles, join new teams, or take on different responsibilities, their access needs can change too.

If access isn't reviewed regularly, employees may end up with more permissions than their roles require. This can increase security risks and make it harder to demonstrate that access controls are working during a SOC 2 audit. Common gaps include:

• Access from previous roles: Employees who change teams or get promoted may keep permissions they no longer need, a problem known as privilege creep

• Temporary access that isn't removed: Admin privileges granted for a specific project or task may remain active after the work is finished

• Permissions that don't match job roles: Even with Role-Based Access Control (RBAC) policies in place, employees' actual access may no longer match what their roles require

• Missing access review records: Without documented reviews and decisions, IT teams may struggle to show auditors that permissions are being checked and updated

The solution: Establish a regular access review process with clear ownership, documented decisions, and follow-up actions. Review permissions against current job responsibilities, paying particular attention to privileged accounts and employees who have changed roles. Keep records of completed reviews to support audit evidence.

How Deel IT helps: Deel IT connects employee lifecycle data with access management workflows, helping IT teams manage permissions across supported applications as employees join, move, or leave the organization. This reduces manual work and helps keep access aligned with current roles. Regular, documented access reviews remain important for demonstrating that controls are operating effectively.

Here are some of the reasons onboarding automation breaks down between HR and IT.

Gap #4: Software access records don't match actual permissions

Software inventories, identity systems, and application records don't always provide an accurate picture of who has access to company tools. Accounts may be missing from central records, permissions may differ from what's documented, and employees may retain access to applications they no longer use.

These discrepancies can make it harder for IT teams to verify access permissions and provide reliable evidence during a SOC 2 audit. Common issues include:

• Outdated software inventories: New applications may be introduced or existing ones retired without those changes being reflected in IT's records

• Accounts missing from central records: Users added directly within an application may not appear in the company's identity system, making it harder to track everyone with access

• Inaccurate permission records: An employee's documented access may differ from the permissions configured inside an application, leaving IT with an incomplete picture of what they can do

• Unused accounts and unnecessary access: Employees may retain active accounts and permissions for applications they no longer use, making it harder for IT teams to verify whether access is still appropriate

The solution: Centralize software and access records, and regularly reconcile them against application-level accounts and actual usage. This helps IT teams identify outdated permissions, reclaim unused licenses, and maintain more accurate records for audit reviews.

How Deel IT helps: Deel IT combines application access management with software usage visibility. Its Access Management capabilities help IT teams manage access through employee lifecycle workflows, while Software Management provides insights into application usage and helps identify unused tools. Together, they help teams improve oversight, reduce manual work, and make more informed software management decisions.

Read: How to Improve IT Compliance with Automated Device Management

Gap #5: Third-party SaaS integrations have more access than they need

SaaS applications often connect to other tools through APIs, OAuth permissions, and third-party integrations. These connections can give applications access to company data, even when employees aren't actively using them.

If integrations aren't reviewed after they're set up, they may retain unnecessary permissions or remain connected long after they're needed. This can create security risks and make it harder to demonstrate effective access controls during a SOC 2 audit.

Common issues include:

• Overly broad integration permissions: Third-party applications may be granted access to more data or functionality than they need.

• Outdated API tokens: Tokens created for specific projects or integrations may remain active after they're no longer needed.

• Unused integrations that remain connected: Applications that employees have stopped using may still have permission to access company systems and data.

• No inventory of connected integrations: Without a clear inventory of connected applications and their permissions, IT teams may struggle to identify which integrations have access to sensitive information.

The solution: Maintain an inventory of third-party integrations, including their permissions and access credentials. Review connections periodically, limit permissions to what's necessary, and revoke access when integrations are no longer needed. Document these reviews and changes to support audit preparation.

How Deel IT helps: Deel IT provides visibility into application usage, helping IT teams identify tools that may no longer be needed. These insights can help prioritize further investigation, but integration permissions, API tokens, and third-party connections still need to be reviewed and managed within the relevant applications.

See also: Identity and Access Management with Deel IT

Close your SOC 2 software access gaps with Deel IT

Managing software access across multiple applications can complicate SOC 2 preparation, especially when HR and IT processes aren't connected. Deel IT links employee lifecycle events with IT workflows, helping teams automate access management, reduce manual work, and maintain more consistent access controls.

With Deel IT, your team can:

• Automate employee onboarding: Provision access to supported applications based on employee information and configured rules, helping ensure new hires receive appropriate permissions

• Streamline offboarding: Automate access removal across connected applications when employees leave, reducing the risk of former employees retaining access

• Improve visibility into access changes: Use Access Management's event log to review provisioning and deprovisioning activity across supported applications

• Keep access aligned with employee changes: Use employee data, such as department, location, and job position, to configure access rules that reflect organizational needs

• Identify opportunities to reduce software waste: Review application usage insights to spot potentially unused tools and decide where further action may be needed

Lifecycle-based access workflows can help organizations maintain more consistent access-control processes. Teams remain responsible for conducting reviews, documenting approvals, and maintaining the evidence required for their SOC 2 audits.

Book a demo to see how Deel IT can support your software access management workflows.

FAQ

Does Deel IT revoke access across every application when an employee leaves?

Deel IT helps automate access removal across supported, connected applications when an employee leaves. Applications that aren't integrated with your access management workflows may require separate offboarding steps. IT teams should regularly review their application inventory to ensure no accounts are overlooked.

How does Deel IT help with SOC 2 access review evidence?

Deel IT helps centralize software access management and reduce manual provisioning and deprovisioning tasks. This gives IT teams better visibility into application access and changes throughout the employee lifecycle. Organizations should also maintain documented access reviews, approvals, and supporting records to meet their specific audit requirements.

Is SOC 2 only relevant to US companies?

No. Although SOC 2 was developed by the American Institute of Certified Public Accountants (AICPA), it is widely recognized by organizations worldwide. Companies selling software or services to enterprise customers may be asked to provide a SOC 2 report regardless of where they're headquartered.

What is the difference between a SOC 2 Type I and Type II report?

A SOC 2 Type I report evaluates the design of an organization's controls at a specific point in time. A Type II report also assesses how effectively those controls operated over a defined period, often six to twelve months. Many enterprise customers prefer Type II reports because they provide evidence of ongoing control effectiveness.

Can Deel IT work with third-party identity providers like Okta or Microsoft Entra ID?

Deel IT can support IT workflows alongside existing identity and HR systems, depending on the integrations available. Teams using providers such as Okta or Microsoft Entra ID (formerly Azure AD) should confirm compatibility and supported access management workflows with Deel before implementation.